Secure input system

ABSTRACT

A secure keyboard input terminal is disclosed in which a secret user identification code number or other confidential data sequence formed from a set of alpha-numeric characters (for example, the ten numerical digits 0 through 9) may be input secretly by a user, the terminal itself comprising (a) a plurality of input keys (in the case of one illustrated apparatus, 10 separate keys), (b) a corresponding plurality of character displays adapted for displaying said characters and (c) electronic circuitry for (1) apparently randomly associating selected ones of said character set to respective individual keys, (2) displaying to the user the character thus associated with each key and (3) translating a signal representing the actuation of a particular key by the user into a signal representing the particular character then associated with that key. In one illustrated embodiment the individual keys are buttons provided with opaque walls surrounding a transparent central bore through which a seven segment numerical display character may be viewed, but only by a person located directly above the keyboard. In one alternative embodiment, the individual key areas have a central bore portion and push button key adjacent to the central bore portion and in other embodiments visual security is maintained by the use of a set of transparent plates with opaque coatings or thin plates between the adjacent plates. One embodiment reassociates the displayed digits prior to the input of a data sequence in response to the manual actuation of a START key and retains the same scrambled association of digits to keys during the successive actuation of keys thus associated with the data sequence to the input. Other embodiments permit the user to manually initiate an automatic random (or apparently random) reassociation between the displayed digits (or other characters) and the individual keys at any time during the inputting of a data sequence or automatically reassociate characters and keys each time an individual data character (or predetermined number of characters) is input. Different types of random or apparently random sequence generating techniques may be employed. A host system processes the output code and accomplishes the desired function following validation.

RELATED APPLICATIONS

This patent application is a continuation-in-part of U.S. patentapplication Ser. No. 146,404, filed May 5, 1980 now U.S. Pat. No.4,333,090.

FIELD OF THE INVENTION

The present invention relates generally to data input devices and moreparticularly to such devices wherein data may be input by means ofmanually actuated keys.

BACKGROUND OF THE INVENTION A. The Prior Art

The art is replete with various types of data entry devices whereindigital data in the form of electronic signals may be manually generatedby the actuation of various types of data input keyboards including suchkeyboards employing thumb wheels, dials, a plurality of toggle switches,latching type key switches arranged in groups and interlocked such thatonly one keyswitch within a group may be activated at any one time, andarrays of momentary actuation pushbuttons in which the sequence that theindividual buttons are actuated is also significant.

Typically, such keyboards have character indicia permanently associatedwith each of the key positions indicating the value of or meaningassociated with the actuation of that particular key.

Accordingly, a bystander in the vicinity of such a prior art keyboardupon witnessing which keys were actuated (and if significant in whatsequence) could then examine the keyboard itself to determine the actualvalue of the data that the user had just input, and the security of thedata would thereby be compromised.

If the user was inputting secret or confidential information (such as asecret identification code known only to himself used to establish hisidentity to an electronic bank teller or other electronic device), thena possible security expedient would be to shield the keyboard with aprivacy screen such that the fingers of the user operating the keyboardwere hidden from view. However, if such a privacy shield were to beeffective, it would also at least partially obscure the view of the userhimself of the indicia associated with the various keys and could thusresult in erroneous data being entered and/or the user being seriouslyinconvenienced. Such a shield would also add bulk and weight to thekeyboard that would be undesirable in a self-contained portableapplication such as an electronic credit card verification system.

Such limitations of the prior art were in part addressed in U.S. Pat.No. 3,587,051 which discloses a device wherein the user responds to therandom illumination of combinations of lights, each of the differentlights being permanently marked with a different digit. The user wouldtake each random pattern of illuminated and non-illuminated lights togenerate mentally a data encoding key which he then would mentally applyto his secret combination to generate a derived code which he then wouldinput to the device by actuating the appropriate switch or switches.Upon his successfully repeating such an encoding process for apredetermined number of different randomly generated patterns, theapparatus would be able to determine whether or not the user was inpossession of the correct secret combination. Although such a prior artsystem might find utility in certain applications involving a limitednumber of sophisticated, highly trained users, it would not appear to beadaptable for use by the general public on an everyday basis.

Also, in U.S. Pat. No. 3,893,073, in FIG. 2, louvers were disclosedlocated in front of a single large numerical display. However, only twoor three louvers were located over the actual numerical display, andthis would be ineffective to significantly reduce the viewing angle.

OBJECTS OF THE DISCLOSED EMBODIMENT

Accordingly, one objective of the present invention as exemplified bythe embodiments disclosed herein is to provide a data entry without fearof the data being compromised in the presence of a bystander.

Another objective is to provide a secure data entry keyboard wherein auser may input data, one character at a time, merely by activating insequence the data keys then identified as being associated with thecorresponding characters to be input, the apparatus being provided withmeans to reassociate the characters with the keys in a random (orapparently random) fashion and to present to the user the results ofsuch reassociation in a convenient form while data is being input.

Yet another related objective is to provide apparatus for scrambling aset of data input characters with respect to the data input keys of aninput terminal, for displaying the respective characters in associationwith their respective associated keys such that only the user of theterminal is aware of the exact nature of the association (and thus abystander observing what keys were actuated in what sequence still wouldnot be able to determine what characters had been input), and forgenerating in response to each key actuation, a signal representing thethen associated character.

Other objectives, including those of a more specific nature, will becomeapparent upon a reading of the following Detailed Description and theDrawings appended thereto.

BRIEF SUMMARY

Briefly, the foregoing and other related objectives (as will become moreclear hereinafter) may be achieved in a presently preferred embodimentof a secure keyboard input terminal in which a secret useridentification code number or other confidential data sequence formedfrom a set of alpha-numeric characters (for example, the ten numericaldigits 0 through 9) may be input secretly by a user, the terminal itselfcomprising (a) a plurality of input key buttons (in the case of oneillustrated apparatus, 10 separate buttons) (b) a correspondingplurality of individual character displays adapted for displayingindividual ones of said characters, and (c) electronic circuitry for (1)apparently randomly associating selected ones of said character set torespective individual keys, (2) displaying the assigned characterassociated with each key to the user and (3) translating a signalresulting from the actuation of a particular key into a signalrepresenting the particular character then associated with the key.

In one embodiment, the individual key buttons are provided with opaquewalls surrounding a transparent central bore through which a sevensegment numerical display character may be viewed, but only by a personlocated directly above the keyboard, thereby further enhancing thesecurity and privacy afforded by the terminal.

In an alternative embodiment which is also illustrated the keyboardcomprises individual key areas defined within a transparent cover plate,each of the key areas being provided with a transparent central boredefined by opaque walls through which a seven segment numerical displaycharacter located below the cover plate may be viewed and with anadjoining push button operatively connected to an electric contact.

In another embodiment, which is presently preferred, the digits of alight emitting diode or a liquid crystal display are provided with a setof transparent plastic (or glass) plates having opaque coatings oropaque shims between the plates, and with the display arranged forviewing through the edges of the plates.

Although the illustrated and described presently preferred embodimentassociates the digits 0 through 9 with ten data keys of the terminal,such that each digit is assigned to one and only one key, the inventionwould also have utility if the same digit might be assigned to more thanone key at a time or if not all members of the character set were alwaysassociated with at least one key. Moreover, although the depictedembodiment reassociates the displayed digits prior to the input of adata sequence in response to the manual actuation of a start key andretains the same scrambled association of digits to keys during thesuccessive actuation of keys thus associated with the data sequencebeing input, in certain types of applications in which the security ofthe input data overrides any consideration of user convenience, then inaccordance with other embodiments it might be preferable to permit theuser to manually initiate the automatic random reassociation between thedisplayed digits (or other characters) and the individual keys at anytime during the inputting of a data sequence by means of a separaterescramble key, or even to cause the displayed characters to becomeautomatically re-scrambled each time an individual data character (orpredetermined number of characters) is entered.

Furthermore, although a disclosed exemplary preferred embodimentassociates the digits 0 through 9 with ten keys of the keyboardutilizing simplified types of random sequence generator digital circuitswhich generate only a limited number of the 3,628,800 possiblepermutations of ten different characters or key positions, the inventionwould also find application in which different types of random orapparently generating techniques were employed.

The present system also contemplates implementation by microprocessorsystem configurations; and association with a host circuit whichcompares or validates the input digital information and actuates acontrol circuit and device in response to the receipt of appropriateinput information.

BRIEF DESCRIPTION OF THE DRAWINGS

For a better understanding of the present invention as exemplified inpresently preferred and alternative embodiment thereof, is made to thefollowing Detailed Description and the appended Drawings in which:

FIG. 1 illustrates in plan view a secure keyboard input terminal inwhich the digits 0 through 9 have been apparently randomly assigned tothe respective keys of a 10 key keyboard prior to the input of data;

FIG. 1A illustrates an alternative embodiment to that illustrated inFIG. 1 in which a different apparently random assignment of digits tokeys is visible and which further differs from the embodiment of FIG. 1in that the push button key is located next to rather than above thecharacter display;

FIG. 2 is an exploded assembly view showing how the individual keybuttons, the seven segment numerical displays and the matrix type switchassemblies utilized in the terminal of FIG. 1 may be assembled withrespect to one another;

FIG. 3 illustrates in cross section the components of FIG. 2 in theirassembled relationship to one another, and to the eye of the user;

FIG. 4 is a method flow chart illustrating a presently preferredembodiment of the method aspects of the present invention;

FIG. 5 depicts various electronic circuits employed in apparatus of thetype illustrated in FIG. 1 and the manner they may be connected to oneanother;

FIG. 6 shows an exemplary type of Random Sequence Generator usable inthe arrangement illustrated in FIG. 5 shown together with the Modulo 10Counter of FIG. 5 and the control signals that effect the concurrentoperation of said generator with said counter;

FIG. 6A shows an alternative exemplary type of Random SequenceGenerator;

FIGS. 7 and 9 show the preferred visually secure input keyboardconfigurations;

FIG. 8 is an end view of one plate which may be included in the opticalgrids of FIGS. 7 and 9; and

FIG. 10 is a block circuit diagram illustrating system utilizationinvolving the principles of the invention.

DETAILED DESCRIPTION OF THE DRAWINGS

Referring now with particularity to FIG. 1, it may be seen that in oneembodiment of the present invention, there is provided a secure datainput keyboard terminal designated generally by the reference numeral 10having ten data pushbuttons designated respectively by referencenumerals 12, 14, 16 . . . 30, with the first, second and third keys (12,14, and 16) being arranged in a first row; the fourth, fifth, and sixthkeys (respectively designated by reference numerals 18, 20, and 22)being arranged in a second row; seventh, eighth, and ninth keys(designated respectively by reference numerals 24, 26, and 28) locatedin a third row; while the tenth key (designated by the reference numeral30) is by itself in a fourth row. Terminal 10 is also provided with astart key 32, the function of which will be more clear hereinafter, andwith an on-off switch 33.

Referring again with particularity to the apparatus illustrated in FIG.1, it may be seen that as depicted, first pushbutton 12 is presentlydisplaying the numeral "0" to the user, second key 14 is displaying thenumeral "9", third key 16 is displaying the numeral "1", fourth key 18is disolaying the numeral "7", fifth key 20 is displaying the numeral"6", sixth key 22 is displaying the numeral "8", seventh key 24 isdisplaying the numeral "4", eighth key 26 is displaying the numeral "3",ninth key 28 is displaying the numeral "5", and tenth 30 is displayingthe numeral "2".

Also visible in FIG. 1 in faint dashed outline below the top surface ofeach of the ten keys 12, 14, etc. are the non-illuminated segments of aconventional 7-segment light-emitting diode display which whenilluminated in various other combinations, may be used to display otherdigits or even non-numerical alpha characters.

Since when the terminal is in use, the segmented display associated witheach of the ten keys presents a different digit character each time theSTART key 32 is depressed and since the individual data keys 12, 14,etc. are utilized not only to display characters associated therewith,but also to manually input data seqences, in the illustrated embodimentthe individual pushbuttons are at least partially transparent and aremounted above minature light emitting 7-segment light emitting diodecharacter displays located on an upper surface of a first circuit board,and have an extension extending through said upper circuit board to anoperative position relative to a snap action contact switch preferablymounted to a second circuit board therebelow, as will become more clearhereinafter with particular reference to FIGS. 2 and 3.

Although the embodiment of the invention illustrated in FIG. 1 employstransparent or at least partially transparent key buttons through whichthe individual segmented displays, each mounted directly below itsrespective button, may be viewed, those skilled in the design andconstruction of digital data terminals will doubtless give considerationto other techniques for physically associating a particular characterdisplay with a particular pushbutton, such as mounting the display toone side of its respective button, or by mounting the ten displays at alocation somewhat spatial arrangement of four rows and three columns (soit will be readily apparent to the user which display corresponds towhich pushbutton), or by labeling the individual keys and employingcorresponding labels on the ten individual character displays.

Furthermore, although a conventional ten key input keyboard arrangementis illustrated in which the ten digits are arranged in three rows eachof three digits and a fourth row of only one digit, it would obviouslybe possible to arrange the ten pushbuttons all in a single row, in whichcase the ten associated character displays may also function as a tendigit output display.

At this point, it should also be observed that although not apparentfrom the view of the apparatus shown in FIG. 1 (but indicateddiagramatically in FIGS. 2 & 3, the individual character display ispreferably provided with a collimating light shield formed by the opaquewalls of the associated key button such that the displayed character maybe seen only when the viewer's eye is located within a narrow range ofangle with respect to the display and thus the characters displayed maybe seen by only one individual at a time. This has the advantageouseffect of furthering the security of the data input by the user, sinceeven if another individual were in the immediate area, even if heobserved which key is then being depressed by the user, he would beunable to determine what data was being input by the user, since hewould not know what character was being displayed as the character thenassociated with a particular key.

Those familiar with the construction of conventional input and outputdata terminals who are otherwise skilled in the art will also befamiliar with other structures that would have the effect of restrictingthe viewing angle from which the displayed characters may be clearlyviewed, such as molded magnifying lenses placed above the displays.Depending upon the degree of security required, and the characteristicsof such other structure, they may be substituted for, or serve as anadjunct to, the collimating light shield discussed in detail herein. Inany event, it is clearly desirable to design the physicalcharacteristics of the mounting of the terminal's keyboard characterdisplays such that a casual bystander cannot readily perceive theindividual characters then being displayed and thereby, merely bywatching which buttons are being depressed in what sequence, knowing thesecret data sequence being input by the user.

As a further aid to security, the device displays a newly generatedsequence of associated key characters only after the user has pressedSTART button 32, and, as soon as the user has completed inputting hisdata, the characters are no longer displayed.

One presently contemplated application for such a secure data inputkeyboard terminal is in a Credit Card Verification System; however, itshould be observed that the present application is directed to a type ofdata input terminal which will doubtless find utility in otherapplications in which it is desired to manually input data by means of akeyboard without compromising the data's security even in the presenceof casual observers.

As examples of such other possible applications, I would mentionautomated or semi-automated bank tellers connected to a bank's centralcomputer, electronic reprogrammable locks such as may be employed inhotels and apartments, electronic combination locks operating the doorsto bank vaults or other secure restricted access areas, or thelike--this list is by no means exhaustive. Depending upon the particularapplication, it may be desired to depart from the configuration of theterminal illustrated in FIG. 1 by providing more or fewer keys, and/orby employing character sets containing a greater or lesser number ofalpha-numeric character than the ten digit illustrated in the Figure.

Referring now to FIGS. 2 and 3, which as noted previously arerespectively an exploded assembly view and a cross-section view of abutton, display, and switch utilized in the FIG. 1 apparatus, it may beseen that the terminal's keyboard may be conveniently integrated withconventional segmented displays by means of at least partiallytransparent pushbuttons 34 each provided with a transparent cover plate35 (preferably of the same color as the light emitted by the lightemitting diodes forming the segments of individual characters so thatthe only thing visible through the cover plate are the illuminatedsegments forming the displayed character). Cover plate 35 covers theupper end of a central bore 36 (which could assume the form of an actualopening machined or molded along the central or vertical axis of theopaque plastic material forming the body of pushbutton 34, or whichalternatively may be formed of a solid transparent material set withinsaid opaque material).

Below the array of individual pushbuttons 34 there is provided an uppercircuit board 37 having a plurality of 7-segment displays 38 mounted toan upper surface 40 thereof, and lower printed circuit board 42 havingmounted on its upper surface 44 a plurality of sealed snap-action typecontacts arranged in a row and column matrix, the exterior of one ofwhich being shown in the figures at reference numeral 46, with its first(row) terminal 47 and second (column) terminal 48.

Each pushbutton 34 is provided with a downwardly protruding leg 49 atone lower edge thereof. Leg 49 passes through an opening 52 provided inupper circuit board 36 and operatively engages the associatedsnap-action switch contact 46. The portion of button 34 immediatelyabove and below a collar 54 co-acts with corresponding openings of upperand lower key guide plates 56a and 56b (see FIG. 3) to locate eachindividual key 34 with respect to its corresponding 7-segment display 38and snap-action switch 46. Collar 54 itself serves to limit the verticaltravel of the key button. Advantageously, contact 46 may have sufficientspring action to return key button 34 to its uppermost position (collar54 touching upper guide plate 56a) when the key is no longer depressed.Alternatively, a second leg (not shown in the drawings) could co-actwith a separate return spring to effect the upward return movement ofbutton 34.

Referring to FIG. 1A, which is noted above, illustrates embodiment of asecure input keyboard alternative to that illustrated in FIG. 1, it maybe seen that in overall appearance there is a strong similarity betweenthese two embodiments. Accordingly, in the case of corresponding orrelated elements in both figures, the corresponding structure in thealternative embodiment has been designated with the same referencenumeral, but differentiated by means of a prime symbol (').

In particular it may be seen that there is provided an input terminaldesignated generally by the reference numeral 10', having ten individualkey areas designated respectively by the reference numerals 12', 14',16', 18', 20', 22', 24', 26', 28', and 30'.

Furthermore, the alternative keyboard 10' is provided with a startbutton 32', which provides a function similar to the start button 32 ofthe FIG. 1 presently preferred embodiment.

As illustrated in the Figure, the digit "5" is presently associated withfirst key 12'. The second and third keys of the first row showrespectively the digits "4" and "3". The remaining rows and columns asdisplayed are presently associated with the digits "2", "1", "0", "9","8", "7" and "6".

It will be recalled that in the case of the embodiment of the FIG. 1,the keyboard terminal is provided with separate relatively large pushbuttons, each of the push buttons having integral therewith acollimating light shield for providing further privacy to the user whilehe is inputting secret data. In the case of the FIG. 1A embodiment, thesame collimating light shields are retained, but are no longerphysically part of a movable push button assembly, but rather are formedby the opaque lower portion of keyboard cover plate 11, the upperportion of said cover plate being transparent in the same manner as theindividual push button cover plates 35 of the FIG. 1 embodiment.

Instead of relatively large movable push buttons, cover plate 11 isprovided with ten key areas each defined by a suitable technique (suchas silk screen printing, an engraved area on the upper surface or theuse of different color plastics integrally molded as one unit) so thatthe digit display portion of the key area formed by the collimatinglight shield (one of which is being shown in broken outline at referencenumeral 36') is in the upper portion of the key area and a relativelysmall push button 13 is located at a lower portion of the same key area.In this manner there results a form of keyboard which is less prone tojamming and smearing problems caused when the keyboard is used in adirty location with possibly greasy fingers. Similarly, key areas 14'through 30' are provided with respective push buttons 15 through 31.

As may be clearly seen from FIG. 3, when the eye of the user (indicateddiagramatically in the Fig. at reference numeral 60) is directly abovethe keyboard such that his line of sight 62 is parallel with theprincipal axis of push button bore 36, and approximately perpendicularto upper keyboard guideplate 56a, then the light from the individuallight emitting diodes forming character display 38 is able to travelunimpeded through central bore 36 and upper plate 35 to the viewer's eye60 along line of sight 62. If, however, the viewer's line of sight issomewhat displaced from that just described (indicated diagramaticallyby the dotted viewer's eye shown at reference numeral 64 and line ofsight 66), the light emitted by character display 38 in the direction ofa thus displaced viewer 64 (the path of such light being showndiagramatically at reference numeral 68) is blocked by the opaquesidewalls of keybutton 34 and accordingly all the viewer sees is a darkvoid, even when some or all of the LED segments forming a particulardisplayed character are illuminated.

The identical light collimating/light blocking function results from thealternative embodiment shown in FIG. 1A, and will accordingly not bedescribed in further detail herein.

Referring now to the flow chart of FIG. 4, it will be clearly seen thatin accordance with its intended method of operation, the apparatus ofFIG. 1 initially awaits an indication from the user of his desire toinput data signified by the pressing of START button 32, this first stepbeing indicated diagramatically in FIG. 4 by block 101.

After the START button has been depressed, the electronics containedwithin the terminal automatically generates a coding scheme in the formof an apparently random sequence of key locations, a function indicateddiagramatically in FIG. 4 by block 103.

As the third step of the method, the electronic circuitry of theapparatus then causes the individual character displays to display thecharacters in association with particular keys of the keyboard in thatsame apparently random sequence, and enables the circuitry's data logicsuch that the user may then input his secret string of data, a functionindicated diagramatically in the FIG. 4 by block 105.

As noted previously, preferably the display of the characters in therandomized sequence is accomplished in such a manner that bystanders areunable to observe which character is associated with which key, so thateven if a bystander observes which fingers of the user pushed whichkeys, he still does not know what data was being input by the user.

The data entry logic having been enabled, the user may now enter hissecret string of data by depressing the various keys associated with thestring's characters and the terminal automatically translates the inputsignals originating from the key contacts into a decoded data string byutilizing the same apparently random sequence, a function indicateddiagramatically in FIG. 4 by block 107.

Finally, once the user has completed entry of his secret data, theterminal then automatically erases the displayed characters and disablesthe data entry logic, thereby maintaining the integrity and secrecy ofthe input data string, a function indicated diagramatically by block109.

Alternatively, the user could manually input a signal by means of amanual RESCRAMBLE switch (which could be on/off switch 33 or STARTbutton 32) or the system could automatically generate a Rescramblesignal once a predetermined number of data characters have been enteredor a predetermined time period has elapsed, which would start thecommencement of a new operational cycle in which a new (but againapparently random) sequence of key locations is generated and replacesthe old sequence, a function indicated in FIG. 4 diagramatically byblock 111 (which is shown in dashed lines to indicate its alternativenature).

Referring now generally to FIG. 5, it may be seen that the electroniccircuitry of the present invention includes separate circuits forperforming the following major functions:

a Modulo 10 Counter (indicated by block 200)

a Random Sequence Generator (indicated by block 202)

a Display Driver (indicated by block 204)

a first Random Access Memory (indicated by block 206)

a second Random Access Memory (indicated by block 208)

a Keyboard Contacts Decoder (indicated by block 210)

a Data Counter (indicated by block 212).

Additionally, the electronics includes the following components forgenerating timing and control signals:

a one-shot pulse generator 214

a Flip-flop 216

a comparator 218, and

AND-gate 220.

START button 32 (see also FIG. 1) generates a Scramble signal "A", thelength of which is more or less random, being determined by how long theSTART button is held down by the user. Scramble signal A is utilized asthe Reset input to Random Sequence Generator 202 to generate a differentapparently random sequence of 4-bit addresses each time the START buttonis depressed. START button 32 also generates a Clear signal CLR whichserves as the Reset input to Data Counter 212. It may be noted thatalthough in certain applications Scramble signal A and Clear signal CLRmay be one and the same, in other alternate preferred embodiments (e.g.,if the characters displayed in association with the various key buttonsare rescrambled in the middle of a data sequence) it is convenient tohave two separate and distinct signals.

Preferably, START button 32 generates manual Scramble signal A by meansof a conventional contact debounce circuit (for instance a pair of crosscoupled NAND-gates), so that spurious control signals are obviated.

Scramble signal A is also utilized by one-shot circuit 214 to generatean Initialization signal "B" once START button 32 has been depressed andreleased. Initialization signal B is employed by first data gate 222controlling data through output bus 226 from Modulo-10 Counter 200leading to I/O port 228 of first RAM 206; this signal also controlssecond data gate 224 located between the output 230 of Random SequenceGenerator 202 and the Address input port 232 of first RAM 206.

When these two gate are enabled by Intialization signal B and signal Bis also applied to the Write Enable input 234 (pulsed by ANDing with CLKto ensure a proper write operation) of first RAM 206, then the binaryequivalents of digits 0 through 9 cyclicly output by Modulo 10 Counter200 will be loaded sequentially into the RAM in accordance with theapparently random sequence of addresses output by Random SequenceGenerator circuit 202 (which it may be noted outputs a four digitaddress, the first two digits of which designate particular one of thefour rows associated with the ten key arrangement illustrated in FIG. 1and the second two digits of which specify a particular one of the threecolumns). Obviously, the duration of Initialization signal B as measuredby the clock signal CLK must be sufficient to guarantee that at leastone full cycle of 10 different digits will have been loaded into the tendifferent addresses corresponding to the ten different actual keys inthe keyboard; however, since the output of Modulo 10 Counter 200 and ofRandom Sequence Generator circuit 202 is cyclic in nature and maintainedin synchronization with each other by means of a common clock signal CLK(and if required a Count Disable signal CE) the fact that Initializationsignal B might in fact have a duration not equal to exactly one suchfull cycle (or even to an integral multiple of one such cycle) is of nomoment.

In accordance with the exemplary embodiment of the Random SequenceGenerator circuit 202 shown in more detail in FIG. 6, the RandomSequence Generator circuit is designed such that it automaticallygenerates a Count Disable signal CE whenever the Generator is generatinga combination of row and column designations not corresponding to anyterminal key location actually in use; thus, assuming that the first rowis designated by the binary number "00", the second row by the binarynumber "01", the third row by the binary number "10" and the fourth rowby the binary number "11"; the first column by the binary number "00",the second column by the binary number "01", the third column by thebinary number "10"; since there is but one key in the fourth row, itsdesignation will be "1100" and binary numbers "1101" and "1110"represent non-existent keys in the second column of the fourth row andin the third column of the fourth row respectively, and Counter 200 doesnot increment when those latter two (non-existent) locations are outputby the Random Sequence Generator. Alternatively, the random sequencegenerator 202 could be designed such that it automatically bypasses rowand column designations not corresponding to any actual terminal key, inwhich case the Count Disable signal CE would not be required. In anyevent, in order that the particular sequence of digits illustrated inFIG. 1 be associated with the particular keys of the keyboard as showntherein, then, at the same time the Modulo 10 Counter 200 outputs abinary number corresponding to the decimal digit "1", which asillustrated in FIG. 1 is associated with the key in the third column ofthe first row, the corresponding output of the Random Sequence Generatorwill be "0010": The decimal number "2" is associated with the fourth rowat the first column, accordingly the second number generated in sequenceby Generator circuit 202 will be "1100", the third number will be"1001", the fourth will be "1000", the fifth "1010", the sixth "0101",the seventh "0100", the eighth "0110", the ninth "0001", the tenth (the0 character) "0000", whereupon the sequence will again repeat itself.

At this point, it will be noted that although the ten characters areoutput in their normal arithmetic sequence by Modulo 10 Counter 200, andthe ten associated locations of actual keyboard keys are output invarying random sequences by Random Sequence Generator 202, it would alsobe possible to generate the address signals corresponding to locationson the keyboard always in the same sequence, and to generate the datasignals applied to I/O port 228 in varying random sequences. Either way,the addresses in first RAM 206 corresponding to the ten active data keysof input terminal 10 would be loaded with the binary representations ofthe respective associated decimal digits in an apparently randomsequence.

Conversely, it would also be theoretically possible for first RAM 206 tobe sequentially loaded with data designating associated key locations,with the address itself within the random access memory correspondingnot to a particular key location, but rather to a particular character.However, such an arrangement would needlessly complicate theunscrambling of data input by the keyboard and detected by KeyboardContacts Decoder 210 as will become more evident hereinafter, and isaccordingly not presently preferred.

I would mention that in certain applications in which it is foreseeablethat Modulo 10 Counter 200 might lose synchronization with RandomSequence Generator 202 (even though they are both driven by the sameclock CLK signal 236), it may be preferable to have the value input viaterminal IN₂ of Display Driver Circuit 204 be provided not directly bythe Modulo 10 Counter itself but rather from I/O output 228 of first RAM206. In that event, it might be necessary to modify somewhat theembodiment shown in FIG. 5 by providing an additional data gate betweenthe Modulo 10 Counter and data bus 226, and by modifying the variouscontrol signals associated with the respective data gates such that whena Strobe signal is present on Strobe line 262 from Keyboard ContactsDecoder 210, then the address supplied on Address input 232 of first RAM206 is the output from Decoder circuit 210 and the I/O port 228 of firstRAM 206 is connected with the I/O port of second RAM 208, but when nosuch Strobe signal is present on Strobe light 262, then the addresssupplied to first RAM 206 is the row and column designation generated byRandom Sequence Generator circuit 202 and the data thereupon output bythe first RAM is applied to the IN₁ input of the Display Driver circuit204. Since the data stored in first RAM 206 remains invariant after theInitialize phase is terminated, it is clear that such an alternativeembodiment will eliminate all such synchronization problems and willguarantee that the character displayed as being associated with aparticular key will of necessity be the character stored in second RAM208 when that key is depressed.

In any event, what is required is a means for automatically apparentlyrandomly assigning scrambled characters to respective individual keysand storing or retaining the particulars so that keyboard data inputsmay subsequently be unscrambled.

As noted above, after the START button has been released,synchronization is maintained between the Modulo 10 Counter 200 and theRandom Sequence Generator 202 by means of Clock pulses signal CLK 236from a common clock and perhaps by a Count Disable signal CE (see FIG.6).

Thus it will be seen that during the more or less fixed time intervalsthat the Initialization signal B is output by one-shot circuit 214, tenbinary numbers corresponding to decimal digits 1 through 10 have beenloaded into addresses in first RAM 206 corresponding to the location ofthe ten data keys of data input terminal 10 in accordance with arandomly generated sequence.

Once Initialization signal pulse B has again gone low, Flip-flop 216 isset by the inverted Initialization signal B and accordingly its Q outputgoes high; assuming that comparator circuit 218 also has a high outputat NO terminal 240, then the Data Enable signal "C" output from AND-gate220 will go high.

At this point it should be remarked that Data Enable signal C will behigh only if Start signal A and Initialization signal B are low;otherwise the Q output of Flip-flop 216 will be low, and accordingly theoutput from AND-gate 220 will be low.

Data Enable signal C is applied to ON input 242 of Display Drivercircuit 204 and accordingly the Display Driver circuit supplies the tencharacter displays of terminal 10 with signals for illuminating (in timemultiplexed fashion) the appropriate segments of the various lightemitting diodes. The output of the Display Driver circuit is a signal onone of the 10 digit lines from second Output Port 246 indicating whichof the character displays is then being driven (this signal beingdirectly derived from the output 230 of Random Sequence Generator 202)and a corresponding signal at first Output Port 248 indicating which ofthe seven segments of that particular character display are then to beilluminated (this latter output being derived in a conventional mannerfrom the binary output of Modulo 10 Counter 200). Conversely, when DataEnable signal C goes low, all outputs from Display Driver circuit 204are disabled and the individual character displays go blank.

Data Enable signal C also controls the flow of data from Output Port 250of Keyboard Contacts Decoder circuit 210 by means of third data gate252. Data Enable signal C is also applied to fourth data gate 254located between I/O port 228 of first RAM 206 and I/O port 256 of secondRAM 208. Additionally, Data Enable signal C is applied to the WriteEnable terminal 258 of second RAM 208 and AND-gate 270 located betweenStrobe output 262 of Contacts Decoder circuit 210 and the input 264 ofData Counter circuit 212. Finally, Data Enable signal C is applied tofifth data gate 265 controlling the flow of data from Data Counter 212to Address port 266 of second RAM 208.

At this point, it may be noted that Keyboard Contact Decoder circuit 210is conventional in nature and may, for instance, comprise a conventionalmultiplex scanner circuit which sequentially applies a signal to thefour rows 266 of the matrix formed by the ten contacts of the keyboardportion of data terminal 10, at the same time testing for the presenceof said signal on one of the three columns 268 of said matrix, therebydetecting a row in electrical contact with one of the three columns 268in said matrix array. When such a contact is detected and apredetermined period of time has elapsed (so that any "bounce"characteristic of the individual electric contacts has effectively beeneliminated) a "Strobe" pulse is generated at Strobe output 262 and ameaningful four bit digital word is present at Output port 250, thefirst two bits of which signifying a particular row, and the second twobits signifying a particular column.

Furthermore, Data Counter circuit 212 in response to the Strobe signalsoutput by the Contact Decoder circuit 210 increments a count addressused to control the operation of second RAM 208, which (since its WriteEnable input 258 has already been enabled by Data Enable signal C)accordingly advances the address to which data from first RAM 206 isrouted, leaving the current output of first RAM 206 permanently writteninto the proceeding address.

Since first RAM 206 has previously been loaded during the Initializationsequence with data representing the characters displayed in associationwith the particular keys of the keyboard; accordingly, as each key issuccessively depressed, a signal designating the particular key isoutput by Contact Decoder circuit 210 to address first RAM 206, and RAM206 thereupon outputs the representation of the character thenassociated with that particular key as an input to second RAM 208 and(shortly thereafter), a Strobe pulse is generated by Contact Decoder 210which advances the count maintained by Data Counter circuit 212, and thecorresponding address input to second RAM 208 is incremented, therebyleaving the decoded data input by the user permanently written into saidsecond RAM, with each successive address in the RAM corresponding to asuccessive entry of a particular digit or character from the keyboard.

It will be noted that the output Count 270 from Data Counter circuit 212is also input to Comparitor circuit 218 where it is compared with binary"1000" (corresponding to decimal "8"). Since, at least for the presentlypreferred embodiment illustrated in the Figure, it is intended that datasequences input by the user will always comprise exactly eight digits orcharacters, and since Data Counter 212 is reset to binary "0" by Clearsignal CLR prior to the data entry logic being enabled, eight digitsinput by means of keyboard 10 will result in eight Strobe pulses beingoutput on Strobe line 262, eight words of corresponding data beingwritten into eight successive locations in second RAM 208, and Counter212 being advanced to the binary equivalent of the number "8", whereuponthe output from Comparitor 218 will go low forcing the Data Enableoutput C from AND-gate 220 also to go low, thereby inhibiting furtherentry of data from keyboard 10 into second RAM 208 and additionallyinhibiting the output of Display Driver circuit 204, thereby effectivelyblanking out the character displays physically associated with theindividual data entry keys.

Although the embodiment described in detail above (and shown in theFigure in solid lines) employs a Clear signal CLR and Scramble signal A,both generated in response to a single manual operation of START button32, it would clearly be possible to replace START button 32 with twoseparate buttons, one of which being a RESCRAMBLE button having thecapability of generating a Scramble signal A but not a Clear signal CLR.

By activating such a RESCRAMBLE button, the user then would be able tocause Random Sequence Generator 202 to generate a new and differentsequence of keyboard locations (which would be stored in the first RAM206 and which would also be used to activate the character displays ofdisplay/keyboard unit 10) without resetting Data Counter 212.Accordingly, upon depressing such a RESCRAMBLE button, the user would beconfronted with a different scrambled association of characters withkeys, but could nevertheless continue to input a continuing sequence ofdata since Data Counter 212 which determines whether successive datawords are loaded into new addresses in second RAM 208 or are writtenover data contained in the earlier addresses has not been reset.

Also visible in FIG. 5 and shown in dotted lines (thereby indicating itsalternative nature) is a One-shot circuit 280 having as its input theoutput of AND-gate 260, which as discussed previously when enabled byData Input signal C applies the Strobe output 262 of Keyboard ContactsDecoder 210 to the input 264 of Data Counter 212, thereby signifyingthat another data character has just been manually input by the user. Byselecting the characteristics of One-shot circuit 280 such that itsoutput is of a period much greater than the period between successiveclock pulses CLK, the output will be, for all practical purposes, asignal of duration sufficiently random that it may serve as analternative Scramble signal A without further processing. If employed,the One-shot circuit should delay its output relative to the Strobepulse present Keyboard Contacts Decoder Strobe output 262, otherwiseFlip-flop 216 would be prematurely reset and the just input datacharacter would not necessarily be loaded into second RAM no. 208.

Referring now specifically to FIG. 6 which, as has been notedpreviously, depicts an exemplary embodiment of a Random SequenceGenerator circuit usable in the arrangement illustrated in FIG. 1 togenerate 80 different random sequences of the ten data input keys ofkeyboard 10, it may be seen that the output of the Sequence Generator isgenerated by a Modulo-4 Counter 300 whose output lines 302 and 304together designate a particular one of the four rows of the keyboard,and by a Modulo-3 Counter 306 whose output lines 308 and 310 designate aparticular one of the four rows of the keyboard, and by a Modulo-3Counter 306 whose output lines 308 and 310 designate a particular one ofthe three columns ("00", "01", or "10").

Also visible in FIG. 6 is Modulo 10 Counter 200 which it will be notedis provided with a Count Disable (CE) signal input 312 (mentionedpreviously in connection with FIG. 5 but not shown therein). CountDisable signal 312 is generated by AND-gate 314 and is high when (a)both output lines (302 and 304) of Modulo 4 Counter 300 are high (i.e.the row being designated is Row no. 4) and (b) the output from OR-gate316 is also high indicating that at least one of the two output lines308 and 310 of Modulo 3 Counter 306 is high (thus the designated columnis not Column No. 1 but rather Column No. 2 or Column No. 3). At thispoint it may be noted that Modulo 4 (Row) Counter 300 is provided withan Up-Down input 318 generated by a first Flip-flop 320 and Modulo 3(Column) Counter 306 is also provided with a similar Up-Down input 322provided by a second Flip-flop 324. Thus, the setting of first Flip-flop320 determines whether the Modulo 4 Counter counts the rows in the Updirection or the Down direction (i.e. from top to bottom or from bottomto top of the keyboard) and second Flip-flop 324 determines whetherModulo 3 Counter 306 counts the Columns Forwards or Backwards (i.e. fromleft to right or from right to left of the keyboard). It will also benoted that the Random Sequence Generator circuit of FIG. 6 is providedwith a third Flip-flop 236 which enables one or the other of AND-gates328 and 330, whose outputs are OR-ed by OR-gate 332 to provide the input334 to Modulo 4 Row Counter 300. Assuming that the Q output of thirdFlip-flop 326 is high (thus enabling the first of the two AND-gatesdesignated by the reference numeral 328) then each time the first outputline 308 of Modulo-3 Counter 306 goes high (that is to say the ColumnCounter is designating the third column) then the Row Counter 300 isincremented to the next Row. Alternatively, if third Flip-flop 326 is inits alternative state, such that output Q is high, and the second of thetwo AND-gates associated with the input to the Row Counter is enabled(namely the AND-gate designated by the reference numeral 330), then whenthe Column Counter 306 is designating the second column, the row counterwill be incremented.

As can be seen from FIG. 6, first Flip-flop 320 second Flip-flop 324 andthird Flip-flop 326 are connected together serially in a divider type ofarrangement with the output of the first Flip-flop serving as the inputto the third, the output of the third serving as the input to thesecond. Since Modulo-10 Counter 200 is provided with a Terminal Countoutput TC, each time the count of nine has been attained, then the TCsignal may be conveniently used as the input to first Flip-flop 320.Such an arrangement will have the effect of guaranteeing that Modulo-10Counter 200, first Flip-flop 320, second Flip-flop 324 and thirdFlip-flop 326 were cycled through all eighty (10×2×2×2) possiblecombinations of conditions in a regular sequence, so that probability ofany one of the eighty possible combinations being the condition of thecircuit at the time that the START signal A is terminated (i.e. the userhas just released his finger from the START button) will be the same,and accordingly the distribution of the eighty different combinationswill be quite uniform, especially if AND-gate 314 is disabled during thescrambling operation.

Thus, by virtue of the particular settings of first Flip-flop 320,second Flip-flop 326 and third Flip-flop 324, the location on thekeyboard output by the Random Sequence Generator circuit will proceedfrom top to bottom or bottom to top, from right to left or left toright, and will be jump from one row to the next from the middle columnor from the end column, thus the circuit is designated such that theModulo 3 and Modulo 4 counters are not in regular synchronization withModulo-10 Counter 200 (because of the randomizing effects of the gatesand Up-Down settings controlled by the three Flip-flops) then for anyparticular starting position within the eight basic cyclic sequencesoutput by Random Sequence Generator circuit, any one of the ten digitsoutput by the Modulo-10 Counter 200 may be associated with any of theten locations (If a synchronous condition were ever detected between therow and column counters on the one hand, and the digit counter on theother hand, its effects could be eliminated by resetting either one orthe other at the end of the scrambling operation). Thus it may be seenthat with the exemplary circuit illustrated, 80 different combinationsof character sequences associated with the particular keys of thekeyboard may be generated in an unpredictable and apparently randommanner.

Although eighty different sequences is more than sufficient to give theappearance of a random generation of sequences, by further modificationsto the illustrated circuit additional different sequences could begenerated, up to the theoretical maximum of ten factorial(10!=3,628,800).

Another example of a Random Sequence Generator circuit is illustrated inFIG. 6a.

Referring specifically to that Figure and also to the preceedingdescription of FIG. 6, it may be seen that first Flip-flop 426 isfunctionally similar to third Flip-flop 326 of FIG. 6 in that itcontrols which of two AND-gates (AND-gate 328 or AND-gate 330) isenabled and accordingly whether the Sequence Generator jumps from onerow to the next at the end column or at the middle column. The secondFlip-flop 424 determines whether the signal applied to Up-Down inputprovided on a Modulo-10 Counter 400 is set to its "Up" position or"Down" position, in much the same way as second Flip-flop 324 of FIG. 6determined whether the Up-Down input 322 to Modulo-3 Counter 306 was setto its Up or its Down position. It may be noted that although Modulo 4(Row) Counter 400 is similar to Modulo 4 Counter 300 of FIG. 6 and theModulo 3 (column) Counter 406 is similar to the Modulo 3 Counter 306 ofFIG. 6, that the Row and Column Counters employed in the embodiment ofFIG. 6a need not be provided with inputs controlling whether they countupwards or downwards.

The control input of first Flip-flop 426 is provided by the output froman AND-gate 450, the inputs of which are Scramble signal A, the firstdigit (D₀) output of a second Modulo-10 Counter 452 and the second digitoutput (D₁) of said second Modulo-10 Counter. The control input tosecond Flip-flop 424 is provided by a second AND-gate 454, inputs ofwhich are the Scramble signal A and the third digit (D₂) of secondModulo-10 Counter 452.

Although the Random Sequence Generator circuit of FIG. 6a in factgenerates only 40 different sequences associating the digits 0 through 9with the ten keys of the Data Entry Keyboard 10, it does so in a mannerwhich I have found to be quite erratic and unpredictable and therefore,for most intents and purposes, "random."

One embodiment of the invention has been described in connection withFIGS. 1 through 6 of the drawings. These drawings and the foregoingdetailed description were included in the prior patent application, Ser.No. 146,404. In the following portion of the Detailed Description, FIGS.7 through 10 will be described. These figures include now preferredsecure display and input switch arrangements, and an overall systemconfiguration.

Referring now to FIG. 7 of the drawings, it is an exploded view showingthe key components of a keyboard display and input unit which isgenerally comparable to that shown in FIGS. 1 through 3 of the drawings.More specifically, the assembly of FIG. 7 includes a cover plate 502, aplurality of transparent or slightly tinted key caps 504 for engagementby the finger or fingers of the user, a transparent Mylar switchingassembly 506 having a series of transparent switching areas 508, whichmay include conductive material such as tin oxide which may be spacedapart and which may come into engagement with one another as the keys504 are depressed. Alternatively, capacitive type switching arrangementsmay be employed. An optical grid 510, which will be described in greaterdetail below, is located between the switching assembly 506, and thelight-emitting displays 512, 514 and 516. The light-emitting displaysmay be mounted above a pair of printed circuit boards 518 and 520 whichinclude the energization and control electronics for the system.

The restricted viewing system as disclosed in FIG. 7 relies on theoptical grid elements 510, one of which is shown in a side view in FIG.8. Viewed from the side, the individual elements making up the opticalgrid include a transparent plate 522 which may be in the order ofone-half to three-quarters of an inch in height, approximately threehundredths of an inch in thickness, and which is provided with a verythin opaque layer 524 which may be in the order of one to severalthousandths of an inch in thickness. The member 522 may be formed of ahigh quality transparent plastic material or of glass, by way ofexample. The layer 524 may be a very thin metallic foil, an opaque layerof paint, or other suitable opaque layers.

The plates in the assembly 510 will extend vertically, when they aremounted for operation by a user. When a person is standing in front ofthe unit, close enough to operate the push buttons, and close enough toview the light-emitting diode display, the viewing angle is such thatthe body and the head of the viewer will prevent others from observingthe display. More specifically, the light-emitting diode display cannotbe viewed from an angle more than about 10 degrees from the side, whenthe optical grid is in place. In addition, a photo cell 526 to bemounted in the opening 528 in the cover plate 502, is employed to reducethe intensity of the light-emitting diode displays 512, 514 and 516 whenthe ambient illumination is low, to avoid a "light pipe" effect of theoptical grid 510 which has been found to occur under very low lightlevel conditions.

Also mounted on the cover plate 502 is the start switch 530 and thesystem state indicating lights 532 and 534, which may be light-emittingdiodes of different colors, where appropriate. Thus, for example, insome alarm systems, the system may be provided with green and red lightsat the entry points, to indicate whether the system is "armed" or not,and the other indicator light may be employed to indicate whether thesystem is in condition to be armed.

The system of FIG. 9 is very similar to that of FIG. 7, with theexception that the key caps 504-1 and the Mylar switching assembly 506-1and 506-2 are not overlying the optical grid 510-1. More specifically,in FIG. 9, the light-emitting diode displays 536 and 538 are locatedcentrally in the assembly, and they are only aligned with the opticalgrid 510-1 and a window 540 which is preferably made of a high strengthtransparent plastic such as polycarbonate, which may also be used forthe transparent material in the optical grid 510 and 510-1. Thearrangement of FIG. 9, has the advantages that the optical grid may ofreduced extent, and that the switches and key caps need not betransparent. They are merely mounted adjacent the LED displays withwhich they are associated, but do not overly them. On the other hand,with the light-emitting diodes directly under the switches 504, in thearrangement of FIG. 7, the association of the switches with the key padis more direct.

It is to be understood, of course, that suitable and conventionalhousing and mounting arrangements will be provided for the assemblies ofFIGS. 7 and 9, in which only the critical active elements have beenshown.

Referring now to FIG. 10, an overall system which may utilize thedevices and circuitry shown in FIGS. 1 through 9 hereof, is disclosed.More specifically, in FIG. 10, a set of seven segment displays is shownat 552, and the corresponding input switches are shown at 554. Thedisplay driver circuitry 556 and the digital data processing circuity558 are shown associated with the display 552 and the input switches554. This digital data processing circuitry 558 includes random accessmemory capability, as indicated by the block 560. The unit 558 may beeither a special logic circuitry including the circuits as shown inFIGS. 5, 6 and 6a, for example, or it may be implemented by amicroprocessor of any of a number of available types. The dataprocessing circuitry may further be coupled to a host system 562, whichmay, for example, be coupled to a number of additional local stations,as generally indicated by the dashed line block 564. In addition to thekeyboard and input switches and the digital data processing circuitry558, the station 564 may include equipment 566 which may, for example,be (1) an electromagnetically opened door latch, (2) a siren or otherwarning device, or (3) a device for performing some other functions suchas the dispensing of an object or of cash, when the proper input signalshave been given.

The keyboard assembly as shown in FIGS. 7 and 9, for example, isincluded within the left-hand dashed line block 564 as shown in FIG. 10.Thus, the electronics indicated by blocks 556 and 558, for example, maybe included on the printed circuit boards 518 and 520 of FIGS. 7 and 9.

Concerning one other aspect of the present invention, in some cases,separate scrambling and unscrambling circuitry may not be needed foridentifying the digit (1 through 10, for example), which has beenselected by the user, in depressing the input keys. Thus, by way of aspecific crude example, let us suppose that each of the numbers 0through 9 are represented by discreet input voltages having differentlevels, for example, starting with one volt representing 0 andcontinuing until the level of 10 volts represent the digit 9. Then, letus assume further that, as the switches are depressed, this voltagelevel is transmitted to an output circuit, to represent the selecteddigit. With this type of arrangement, special unscrambling circuitrywhich identifies the particular LED to which a particular number hasbeen randomly assigned, will not be necessary. It is also noted that twoof the keys in the displays of FIGS. 7 and 9 may be permanentlyallocated to the pound (#) and the asterisk (*) symbols, with noassociated numeric/alphanumeric display for those keys. These keys arecommonly used for a variety of special purpose functions by the hostsystem, such as an instant panic signal for an alarm or entry system.

In conclusion, it is to be understood that the present invention is notlimited to that precisely as shown and described hereinabove. Morespecifically, the system may be implemented either by a detailed speciallogic circuit or by microprocessor control electronic circuitry; variousphysical arrangements of the input switches may be employed, and otherequivalent mechanical arrangements and electrical circuit configurationsmay be employed to accomplish the same functions as disclosedhereinabove. Accordingly, the present invention is not limited to thatprecisely as set forth hereinabove.

What is claimed is:
 1. A secure keyboard input system comprising:akeyboard having a plurality of individual keys and correspondingcharacter displays; means for generating apparently random pairingsbetween the individual keys and individual characters included in a setof characters, and means for displaying the individual characters incorrespondence with the respective paired keys; means for translatingthe actuation of particular keyboard keys into signals representing thecorresponding characters paired to said keys; means for restricting theview of the character displays from other than the individual operatingthe keyboard, said view restricting means including optical grid meansincluding a plurality of closely spaced transparent plates havingnon-transparent means between said plates, overlying said displayingmeans, for restricting the angle of view to less than ten degrees fromperpendicularity to the keyboard; and means for selectively initiating anew set of apparently random pairings between said keys and saidcharacters.
 2. A secure keyboard input system as defined in claim 1further comprising photosensitive means for reducing the energization ofthe displaying means under low light level conditions, to preclude fiberoptic surface effect viewing of the displayed characters.
 3. A securekeyboard input system as defined in claim 1 further comprising:anactuation device; and means for processing said signals and forenergizing said actuation device upon validation of said signals.
 4. Asecure keyboard input system as defined in claim 1 wherein said keys aretransparent and overlie said optical grid means.
 5. A secure keyboardinput system as defined in claim 1 wherein said keys are mountedrespectively immediately beside the associated displaying means for eachof the respective characters.
 6. A secure keyboard input system asdefined in claim 1 wherein said translating means includes unscramblingmeans responsive to said random pairings for producing binary outputsignals corresponding to the individual displayed characters,notwithstanding changes in the apparently random pairings.
 7. A securekeyboard input system as defined in claim 3 including microprocessormeans for sampling the keyboard and for controlling said actuationdevice.
 8. A secure input keyboard system as defined in claim 1 whereinsaid non-transparent means is a layer of opaque material in the order ofone to several thousandths of an inch in thickness.
 9. A secure keyboardinput system comprising:means for displaying a plurality of charactersin a variable display; means for restricting view of said variabledisplay to less than ten degrees from perpendicularity to said display,said view restricting means including an optical grid made up of aplurality of thin transparent plates having means for blockingvisibility between each pair of adjacent plates; and a keyboard havingmovable transparent keying means associated respectively with andoverlying individual means for displaying characters in said variabledisplay.
 10. A secure keyboard input system as defined in claim 9wherein transparent electrical switching means are located between saidkeying means and said optical grid for actuation by said keying means.